Data Processing Agreement – StrixVerse Inbox

This is an English translation provided for convenience. If there is any discrepancy, the Portuguese version prevails.

This agreement complies with Article 28 of the General Data Protection Regulation (GDPR) and forms part of the StrixVerse Inbox Terms and Conditions.

Parties and acceptance

• Controller ("Customer"): the entity identified in the electronic acceptance record made when subscribing.
• Processor ("StrixVerse"): António Carlos Martins, sole trader (empresário em nome individual), tax number (NIF) 266097570, with professional address at Rua de Vilar, n.º 41, Coucieiro, Vila Verde, Braga, Portugal, operating under the StrixVerse brand.

The Customer accepts this agreement in electronic form, in accordance with Article 28(9) GDPR, by accepting the Terms and Conditions. StrixVerse keeps a record of the acceptance: entity, tax number, name and email of the person accepting, date and time, and version accepted. Previous versions of this agreement remain published on this agreement's page.

1. Subject matter

1.1. StrixVerse processes personal data on behalf of the Customer to provide the StrixVerse Inbox service, under the Terms and Conditions.

1.2. The subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects are described in Annex 1.

2. Customer instructions

2.1. StrixVerse processes data only on the Customer's documented instructions. The Terms and Conditions, this agreement and the configuration the Customer makes in the service (connected channels, knowledge given to the assistant, rules and permissions) constitute instructions.

2.2. StrixVerse immediately informs the Customer if it considers that an instruction infringes the GDPR or other data protection law.

2.3. If the law requires StrixVerse to process the data differently, StrixVerse informs the Customer before processing, unless the law prohibits it.

3. Confidentiality

Persons authorised by StrixVerse to process the data are bound by a duty of confidentiality, contractual or statutory, which continues after the end of this agreement.

4. Security

StrixVerse applies the technical and organisational measures in Annex 2, appropriate to the risk under Article 32 GDPR. It may update them, provided the level of security does not decrease.

5. Sub-processors

5.1. The Customer gives general authorisation for StrixVerse to use sub-processors. The sub-processors in use are listed in Annex 1.

5.2. StrixVerse notifies the Customer by email, at least 30 days in advance, before adding or replacing a sub-processor. The Customer may object within that period, on reasonable grounds related to data protection. If no agreement is reached, the Customer may cancel the service without penalty and is refunded for any period paid and not used.

5.3. StrixVerse imposes on each sub-processor data protection obligations equivalent to those in this agreement. It remains liable to the Customer for compliance with those obligations.

6. International transfers

Data is hosted in the European Union (Finland). Transfers outside the European Economic Area, listed in Annex 1, rely on an adequacy decision (including the EU-US Data Privacy Framework) or on the standard contractual clauses approved by the European Commission.

7. Data subject rights

7.1. The service allows the Customer to view, correct and delete contacts and conversations. StrixVerse exports this data at the Customer's request.

7.2. If a data subject addresses a request directly to StrixVerse, StrixVerse forwards it to the Customer within 5 working days. Except as provided in point 7.3, it does not reply to the data subject without the Customer's instructions, but may confirm that the request was received and forwarded.

7.3. The Customer instructs StrixVerse to carry out deletion requests addressed to it directly by data subjects and to confirm their completion to them, within a maximum of 30 days, unless the Customer objects in writing within 5 working days of the request being forwarded.

7.4. StrixVerse helps the Customer respond to data subject requests (Articles 15 to 22 GDPR), as far as possible and taking into account the nature of the processing.

8. Personal data breaches

8.1. StrixVerse notifies the Customer without undue delay, and at most 48 hours after becoming aware of a personal data breach affecting the Customer's data.

8.2. The notification includes, as far as known:

• the nature of the breach;
• the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures taken or proposed;
• the contact point for more information.

8.3. StrixVerse cooperates with the Customer so that it can meet the deadlines for notifying the CNPD and data subjects (Articles 33 and 34 GDPR).

9. Assistance to the Customer

StrixVerse gives the Customer the information reasonably necessary for impact assessments and prior consultations with the CNPD (Articles 35 and 36 GDPR), taking into account the nature of the processing and the information available to it.

10. End of processing

10.1. When the contract ends, the Customer may request an export of conversations and contacts for 30 days.

10.2. After that period, StrixVerse deletes all of the Customer's personal data, including copies. Backups are deleted at most 30 days later, through automatic rotation.

10.3. Data that the law requires to be kept is excluded. At the Customer's request, StrixVerse confirms the deletion in writing.

11. Audits and information

11.1. StrixVerse makes available to the Customer the information necessary to demonstrate compliance with this agreement.

11.2. StrixVerse allows audits by the Customer or by an auditor mandated by it and bound by confidentiality. 30 days' prior notice is required and audits are limited to one per year, except after a data breach or at the request of the CNPD.

11.3. Audits may not give access to other customers' data. Each party bears its own costs.

12. Customer obligations

The Customer guarantees that it:

• has a legal basis for the processing it requests;
• informs data subjects, in its privacy policy, that it uses StrixVerse Inbox and an artificial intelligence assistant;
• only enters into the service the data necessary to support its customers.

13. Liability

Each party's liability follows Article 82 GDPR and the limits in the Terms and Conditions, insofar as the law permits.

14. Term and precedence

14.1. This agreement remains in force for as long as StrixVerse processes data on behalf of the Customer.

14.2. If there is a conflict between this agreement and the Terms and Conditions regarding data protection, this agreement prevails.

14.3. Portuguese law applies and the courts of the district of Braga have jurisdiction.

---

Annex 1 – Description of processing and sub-processors

Sub-processors

Meta (WhatsApp, Instagram, Messenger) and Shopify are not sub-processors of StrixVerse. They are platforms that the Customer uses and connects to the service, under the Customer's own contracts with those companies. They connect to the service through StrixVerse apps: one for Instagram and Messenger, one for WhatsApp and a custom app in the Customer's Shopify store.

Annex 2 – Technical and organisational measures